Trusted push now adds the tag to every first level delegation role for which we have keys and for which the tag conforms to path restrictions.